The Ministry of Electronics and Information Technology (MeitY) has recently on July 27, 2018 published the Justice BN Srikrishna Committee of Experts Report on Data Protection as well as a Personal Data Protection Bill, 2018 (“Bill”).

This Bill is the result of the deliberations of the Justice B. Srikrishna Committee to review and recommend necessary changes to be made to the current data protection regime under the Information Technology Act, 2000 along with the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 keeping in mind the technological changes.

Aim of the Bill:

1. Create a relationship of trust between persons and entities processing their personal data;
2. To specify the rights of individuals whose personal data are processed;
3. To create a framework for implementing organisational and technical measures in processing personal data;
4. To lay down norms for cross-border transfer of personal data;
5. To ensure the accountability of entities processing personal data;
6. To provide remedies for unauthorised and harmful processing, and;
7. To establish a Data Protection Authority for overseeing processing activities.

Key Highlights of the Bill:

1. A new definition for Personal Data has been introduced and the definition for Sensitive Personal Data has been revised to include new parameters such as religious and political views, caste and tribe etc., which were earlier not present;
2. Concepts of data principal, data fiduciary and data processor has been introduced;
3. Concept of Anonymization of data has been introduced;
4. The Bill contemplates the creation of the Data Protection Authority of India as an independent regulator;
5. Requirement for appointing a data protection officer and conducting regular data audits has been introduced;
6. The concept of right to be forgotten, data portability and cross-border flow of data has been introduced;
7. A requirement has been made for collection and processing of data must be for lawful purposes;
8. Special provisions for the protection and processing of the data of a child has been introduced;
9. Reporting requirements in the event of a data breach has been introduced.

The Bill also proposes to have an overriding effect on few provisions of the following enactments:

• Information Technology Act, 2000;
• The Right to Information Act, 2005.

For a detailed read on the proposed amendments of the Bill, please click on the hyperlink below.

Source: Ministry of Electronics and Information Technology

Share this: